Review – 3 Advisories and 1 Update Published – 9-10-26

Today CISA’s NCCIC-ICS published one control system security advisory for products from AVEVA, and two medical device security advisories for products from Orthanc and NextGen. They also updated a control system advisory for products from ST Engineering. 

Advisories  

Aveva Advisory - This advisory describes four vulnerabilities in the AVEVA Pipeline Integrity Monitor. Two of the vulnerabilities were reported by Adham Khairy Ramadan via HackerOne. 

Orthanc Advisory - This advisory describes an integer overflow or wraparound vulnerability in the Orthanc DICOM Server. The vulnerability was reported to CISA by Andrej Tomci 

NextGen Advisory - This advisory describes three vulnerabilities in the NextGen Healthcare Mirth Connect. The vulnerabilities were reported to CISA by Abhinav Agarwal  

Updates  

ST Engineering Update - This update provides additional information on the iDirect iQ-Series Terminals advisory that was originally on July 2nd, 2026. The new information includes adding two vulnerabilities. 

For more information on these advisories, including DTRH looks at exploits in the wild and POC, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-1-update-published-091 - subscription required. 

Review – 3 Advisories and 3 Updates Published – 7-2-26

Today CISA’s NCCIC-ICS published three control system security advisories for products from Gardyn, CubeSpace, and ST Engineering. They updated two control system advisories for products from Gardyn and Mitsubishi. They also updated a medical device security advisory for products from WHILL. 

Advisories  

Gardyn Advisory - This advisory describes three vulnerabilities in the Gardyn IoT Hub. 

CubeSpace Advisory - This advisory describes an improper verification of cryptographic signature vulnerability in the CubeSpace CW0057 Reaction Wheel. 

ST Engineering Advisory - This advisory describes two vulnerabilities in the ST Engineering iDirect iQ-Series Terminals. 

Updates  

Gardyn Update - This update provides additional information on the Home Kit advisory that was originally published on February 24, 2026, and most recently updated on April 2nd, 2026. 

Mitsubishi Update - This update provides additional information on the CNC Series advisory that was originally published on October 17th, 2024, and most recently updated on December 18th, 2025. 

WHILL Update - This update provides additional information on the C2 Electric Wheelchairs advisory that was originally published on December 30th, 2025, and most recently updated on March 24th, 2026. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/3-advisories-and-3-updates-published-2e9 - subscription required.